Many state and local education agency websites aren’t disclosing the presence of third-party tracking services, which can use information about users’ browsing history and online activity to target advertisements, according to a study released by EdTech Strategies, an education consulting group.

More than 90 percent of all state departments of education and all but one of a sample of 159 school districts are using free, cloud-based tracking tools offered by tech giants Google, Facebook, and Twitter to gather and analyze information about their audience, the study found. Those free site analytics come with a cost. Companies provide them in exchange for the ability to track users’ internet activity and browsing history over time, gathering information they can use to show targeted ads.

The study found that about a third of the state departments of education that allowed ad tracking on their websites either didn’t mention it on the site or provided misleading information in a site privacy policy that suggested users’ activity was not being recorded and stored by a third party. Thirty of the districts (19 percent) posted a district privacy policy on their website. Of those, about two-thirds mentioned the use of tracking—but, like the state education departments, some mischaracterized how users would be tracked.

The report includes steps states and districts can take to evaluate their use of third-party tracking tools.